<!DOCTYPE html>
<html class="writer-html5" lang="en" >
<head>
  <meta charset="utf-8" /><meta name="generator" content="Docutils 0.18.1: http://docutils.sourceforge.net/" />

  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
  <title>Quickstart &mdash; vt-py  documentation</title>
      <link rel="stylesheet" href="_static/pygments.css" type="text/css" />
      <link rel="stylesheet" href="_static/css/theme.css" type="text/css" />
  <!--[if lt IE 9]>
    <script src="_static/js/html5shiv.min.js"></script>
  <![endif]-->

        <script data-url_root="./" id="documentation_options" src="_static/documentation_options.js"></script>
        <script src="_static/doctools.js"></script>
        <script src="_static/sphinx_highlight.js"></script>
    <script src="_static/js/theme.js"></script>
    <link rel="index" title="Index" href="genindex.html" />
    <link rel="search" title="Search" href="search.html" />
    <link rel="next" title="API reference" href="apireference.html" />
    <link rel="prev" title="Overview" href="overview.html" />
</head>

<body class="wy-body-for-nav">
  <div class="wy-grid-for-nav">
    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
      <div class="wy-side-scroll">
        <div class="wy-side-nav-search" >



          <a href="index.html" class="icon icon-home">
            vt-py
          </a>
<div role="search">
  <form id="rtd-search-form" class="wy-form" action="search.html" method="get">
    <input type="text" name="q" placeholder="Search docs" aria-label="Search docs" />
    <input type="hidden" name="check_keywords" value="yes" />
    <input type="hidden" name="area" value="default" />
  </form>
</div>
        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
              <p class="caption" role="heading"><span class="caption-text">Contents:</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="howtoinstall.html">How to install</a></li>
<li class="toctree-l1"><a class="reference internal" href="overview.html">Overview</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">Quickstart</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#get-information-about-a-file">Get information about a file</a></li>
<li class="toctree-l2"><a class="reference internal" href="#get-information-about-an-url">Get information about an URL</a></li>
<li class="toctree-l2"><a class="reference internal" href="#scan-a-file">Scan a file</a></li>
<li class="toctree-l2"><a class="reference internal" href="#scan-an-url">Scan an URL</a></li>
<li class="toctree-l2"><a class="reference internal" href="#download-a-file">Download a file</a></li>
<li class="toctree-l2"><a class="reference internal" href="#start-and-abort-a-retrohunt-job">Start and abort a Retrohunt job</a></li>
<li class="toctree-l2"><a class="reference internal" href="#create-a-livehunt-ruleset">Create a LiveHunt ruleset</a></li>
<li class="toctree-l2"><a class="reference internal" href="#closing">Closing</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="apireference.html">API reference</a></li>
</ul>

        </div>
      </div>
    </nav>

    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
          <a href="index.html">vt-py</a>
      </nav>

      <div class="wy-nav-content">
        <div class="rst-content">
          <div role="navigation" aria-label="Page navigation">
  <ul class="wy-breadcrumbs">
      <li><a href="index.html" class="icon icon-home" aria-label="Home"></a></li>
      <li class="breadcrumb-item active">Quickstart</li>
      <li class="wy-breadcrumbs-aside">
            <a href="_sources/quickstart.rst.txt" rel="nofollow"> View page source</a>
      </li>
  </ul>
  <hr/>
</div>
          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
           <div itemprop="articleBody">

  <section id="quickstart">
<h1>Quickstart<a class="headerlink" href="#quickstart" title="Permalink to this heading"></a></h1>
<section id="get-information-about-a-file">
<h2>Get information about a file<a class="headerlink" href="#get-information-about-a-file" title="Permalink to this heading"></a></h2>
<p>Start by importing the <cite>vt</cite> module:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="kn">import</span> <span class="nn">vt</span>
</pre></div>
</div>
<p>Create a client, replace <cite>&lt;apikey&gt;</cite> with your actual VirusTotal API key:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">client</span> <span class="o">=</span> <span class="n">vt</span><span class="o">.</span><span class="n">Client</span><span class="p">(</span><span class="s2">&quot;&lt;apikey&gt;&quot;</span><span class="p">)</span>
</pre></div>
</div>
<p>Ask for the file you are interested in, you can replace the hash in the example
with some other SHA-256, SHA-1 or MD5:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">file</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">get_object</span><span class="p">(</span><span class="s2">&quot;/files/44d88612fea8a8f36de82e1278abb02f&quot;</span><span class="p">)</span>
</pre></div>
</div>
<p>Now <cite>file</cite> is an instance of <code class="xref py py-class docutils literal notranslate"><span class="pre">vt.Object</span></code> that contains information
about the requested file. This object have the attributes returned in the
API response which are listed in the <a class="reference external" href="https://docs.virustotal.com/reference/files">VirusTotal API v3 documentation</a>. Some examples:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">file</span><span class="o">.</span><span class="n">size</span>
<span class="go">68</span>
</pre></div>
</div>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">file</span><span class="o">.</span><span class="n">sha256</span>
<span class="go">&#39;275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f&#39;</span>
</pre></div>
</div>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">file</span><span class="o">.</span><span class="n">type_tag</span>
<span class="go">&#39;text&#39;</span>
</pre></div>
</div>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">file</span><span class="o">.</span><span class="n">last_analysis_stats</span>
<span class="go">{&#39;failure&#39;: 0, &#39;harmless&#39;: 0, &#39;malicious&#39;: 62, &#39;suspicious&#39;: 0, &#39;timeout&#39;: 0, &#39;type-unsupported&#39;: 9, &#39;undetected&#39;: 2}</span>
</pre></div>
</div>
<p>Alternatively, you can use the <code class="xref py py-meth docutils literal notranslate"><span class="pre">vt.Object.get()</span></code> method for retrieving
object’s attributes:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">file</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s2">&quot;size&quot;</span><span class="p">)</span>
<span class="go">68</span>
</pre></div>
</div>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">file</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s2">&quot;type_tag&quot;</span><span class="p">)</span>
<span class="go">&#39;text&#39;</span>
</pre></div>
</div>
<p>This method is useful for those attributes that are optional and do not appear
in all files. For example, a Portable Executable (PE) file won’t have the <cite>pdf_info</cite>
attribute, and PDF document won’t have the <cite>pe_info</cite> attribute. This means that
<cite>file.pe_info</cite> will fail for PDF files but with <cite>file.get(“pe_info”)</cite> you are
on the safe side, as it will return <cite>None</cite> if the <cite>pe_info</cite> attribute is not
present.</p>
</section>
<section id="get-information-about-an-url">
<h2>Get information about an URL<a class="headerlink" href="#get-information-about-an-url" title="Permalink to this heading"></a></h2>
<p>Create a client as explained in the previous section and ask for the desired
URL as follows:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">url_id</span> <span class="o">=</span> <span class="n">vt</span><span class="o">.</span><span class="n">url_id</span><span class="p">(</span><span class="s2">&quot;http://www.virustotal.com&quot;</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">url</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">get_object</span><span class="p">(</span><span class="s2">&quot;/urls/</span><span class="si">{}</span><span class="s2">&quot;</span><span class="p">,</span> <span class="n">url_id</span><span class="p">)</span>
</pre></div>
</div>
<p>In this case the code is not as straightforward as it was for getting a file.
While retrieving a file any of its hashes can be used as the file identifier,
but with URLs is a bit more complicated. You must use <code class="xref py py-func docutils literal notranslate"><span class="pre">vt.url_id()</span></code> for
generating the appropriate identifier. You can find more information about why
this is necessary in:
<a class="reference external" href="https://docs.virustotal.com/reference/url">https://docs.virustotal.com/reference/url</a>.</p>
<p>Also notice how we are using a placeholder <cite>{}</cite> in the path. The placeholder
will be replaced with the value of <cite>url_id</cite>. This works exactly like Python’s
<a class="reference external" href="https://pyformat.info/">new-style string formatting</a> using the <cite>.format()</cite>
function. This other code is equivalent:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">url</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">get_object</span><span class="p">(</span><span class="s2">&quot;/urls/</span><span class="si">{}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">url_id</span><span class="p">))</span>
</pre></div>
</div>
<p>The returned object contains the URL attributes. Some examples:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">url</span><span class="o">.</span><span class="n">times_submitted</span>
<span class="go">213730</span>
</pre></div>
</div>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">url</span><span class="o">.</span><span class="n">last_analysis_stats</span>
<span class="go">{&#39;harmless&#39;: 61, &#39;malicious&#39;: 0, &#39;suspicious&#39;: 1, &#39;timeout&#39;: 0, &#39;undetected&#39;: 8}</span>
</pre></div>
</div>
</section>
<section id="scan-a-file">
<h2>Scan a file<a class="headerlink" href="#scan-a-file" title="Permalink to this heading"></a></h2>
<p>Before scanning a file is highly recommended that you look up for it as
described in <a class="reference external" href="#get-information-about-a-file">Get information about a file</a>.
If the file already exists and the latest analysis is fresh enough, you can
use that instead of scanning the file again. If not, you can scan it with:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s2">&quot;/path/to/file&quot;</span><span class="p">,</span> <span class="s2">&quot;rb&quot;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
<span class="gp">&gt;&gt;&gt; </span>  <span class="n">analysis</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">scan_file</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
</pre></div>
</div>
<p>When <code class="xref py py-meth docutils literal notranslate"><span class="pre">vt.Client.scan_file()</span></code> returns the analysis is not completed yet,
the object returned only has the analysis ID but not attributes. In order to
track the status of the analysis you must ask for the analysis object until
it’s status is <cite>completed</cite>:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="k">while</span> <span class="kc">True</span><span class="p">:</span>
<span class="gp">&gt;&gt;&gt; </span>  <span class="n">analysis</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">get_object</span><span class="p">(</span><span class="s2">&quot;/analyses/</span><span class="si">{}</span><span class="s2">&quot;</span><span class="p">,</span> <span class="n">analysis</span><span class="o">.</span><span class="n">id</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span>  <span class="nb">print</span><span class="p">(</span><span class="n">analysis</span><span class="o">.</span><span class="n">status</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span>  <span class="k">if</span> <span class="n">analysis</span><span class="o">.</span><span class="n">status</span> <span class="o">==</span> <span class="s2">&quot;completed&quot;</span><span class="p">:</span>
<span class="gp">&gt;&gt;&gt; </span>     <span class="k">break</span>
<span class="gp">&gt;&gt;&gt; </span>  <span class="n">time</span><span class="o">.</span><span class="n">sleep</span><span class="p">(</span><span class="mi">30</span><span class="p">)</span>
</pre></div>
</div>
<p>Alternatively you can use the <cite>wait_for_completion</cite> argument:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s2">&quot;/path/to/file&quot;</span><span class="p">,</span> <span class="s2">&quot;rb&quot;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
<span class="gp">&gt;&gt;&gt; </span>  <span class="n">analysis</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">scan_file</span><span class="p">(</span><span class="n">f</span><span class="p">,</span> <span class="n">wait_for_completion</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span>
</pre></div>
</div>
<p>When <cite>wait_for_completion</cite> is True <code class="xref py py-meth docutils literal notranslate"><span class="pre">vt.Client.scan_file()</span></code> doesn’t return
until the analysis has been completed.</p>
</section>
<section id="scan-an-url">
<h2>Scan an URL<a class="headerlink" href="#scan-an-url" title="Permalink to this heading"></a></h2>
<p>Scanning a URL is very similar to <a class="reference external" href="#scan-a-file">scanning a file</a>, you just
need to use <code class="xref py py-meth docutils literal notranslate"><span class="pre">vt.Client.scan_url()</span></code> instead of <code class="xref py py-meth docutils literal notranslate"><span class="pre">vt.Client.scan_file()</span></code>:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">analysis</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">scan_url</span><span class="p">(</span><span class="s1">&#39;https://somedomain.com/foo/bar&#39;</span><span class="p">)</span>
</pre></div>
</div>
</section>
<section id="download-a-file">
<h2>Download a file<a class="headerlink" href="#download-a-file" title="Permalink to this heading"></a></h2>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>This feature is available only for premium users.</p>
</div>
<p>Downloading a file it’s very simple, you only need to provide the hash and a
file-like object where the file’s content will be written to. The target file
must be opened in <cite>“wb”</cite> mode:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s2">&quot;/path/to/target_file&quot;</span><span class="p">,</span> <span class="s2">&quot;wb&quot;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
<span class="gp">&gt;&gt;&gt; </span>  <span class="n">client</span><span class="o">.</span><span class="n">download_file</span><span class="p">(</span><span class="s2">&quot;44d88612fea8a8f36de82e1278abb02f&quot;</span><span class="p">,</span> <span class="n">f</span><span class="p">)</span>
</pre></div>
</div>
</section>
<section id="start-and-abort-a-retrohunt-job">
<h2>Start and abort a Retrohunt job<a class="headerlink" href="#start-and-abort-a-retrohunt-job" title="Permalink to this heading"></a></h2>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>This feature is available only for premium users.</p>
</div>
<p>Create an empty object of type <cite>retrohunt_job</cite> and set its <cite>rules</cite> attribute:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">job</span> <span class="o">=</span> <span class="n">vt</span><span class="o">.</span><span class="n">Object</span><span class="p">(</span><span class="s2">&quot;retrohunt_job&quot;</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">job</span><span class="o">.</span><span class="n">rules</span> <span class="o">=</span> <span class="s2">&quot;rule test { condition:false }&quot;</span>
</pre></div>
</div>
<p>Post the object to the <cite>/intelligence/retrohunt_jobs</cite> collection:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">job</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">post_object</span><span class="p">(</span><span class="s2">&quot;/intelligence/retrohunt_jobs&quot;</span><span class="p">,</span> <span class="n">obj</span><span class="o">=</span><span class="n">job</span><span class="p">)</span>
</pre></div>
</div>
<p>Notice that <cite>job</cite> has been replaced with the value returned by
<code class="xref py py-func docutils literal notranslate"><span class="pre">vt.Client.post_object()</span></code>, so now <cite>job</cite> has an ID and additional
attributes.</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">job</span><span class="o">.</span><span class="n">id</span>
<span class="go">&#39;username-123456789&#39;</span>
</pre></div>
</div>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">job</span><span class="o">.</span><span class="n">status</span>
<span class="go">&#39;starting&#39;</span>
</pre></div>
</div>
<p>With the object identifier you can ask for the job again a see it making
progress. Wait for a few seconds and do:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">job</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">get_object</span><span class="p">(</span><span class="s2">&quot;/intelligence/retrohunt_jobs/</span><span class="si">{}</span><span class="s2">&quot;</span><span class="p">,</span> <span class="n">job</span><span class="o">.</span><span class="n">id</span><span class="p">)</span>
</pre></div>
</div>
<p>The job status should have changed to <cite>running</cite>:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">job</span><span class="o">.</span><span class="n">status</span>
<span class="go">&#39;running&#39;</span>
</pre></div>
</div>
<p>And the progress attribute should show the completion percentage:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">job</span><span class="o">.</span><span class="n">progress</span>
<span class="go">1.4145595</span>
</pre></div>
</div>
<p>Let’s abort the job:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">response</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">post</span><span class="p">(</span><span class="s2">&quot;/intelligence/retrohunt_jobs/</span><span class="si">{}</span><span class="s2">/abort&quot;</span><span class="p">,</span> <span class="n">job</span><span class="o">.</span><span class="n">id</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">response</span><span class="o">.</span><span class="n">status</span>
<span class="go">200</span>
</pre></div>
</div>
<p>Here we are using <code class="xref py py-meth docutils literal notranslate"><span class="pre">vt.Client.post()</span></code> instead of <code class="xref py py-meth docutils literal notranslate"><span class="pre">vt.Client.post_object()</span></code>,
this is because the <a class="reference external" href="https://docs.virustotal.com/reference/abort-retrohunt-job">/intelligence/retrohunt_jobs/{id}/abort</a>
endpoint doesn’t expect an object, just a POST request with an empty body. The
result from <code class="xref py py-meth docutils literal notranslate"><span class="pre">vt.Client.post()</span></code> is a <code class="xref py py-class docutils literal notranslate"><span class="pre">vt.ClientResponse</span></code> instance.</p>
</section>
<section id="create-a-livehunt-ruleset">
<h2>Create a LiveHunt ruleset<a class="headerlink" href="#create-a-livehunt-ruleset" title="Permalink to this heading"></a></h2>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>This feature is available only for premium users.</p>
</div>
<p>Create an empty object of type <cite>hunting_ruleset</cite> and set its <cite>name</cite> and
<cite>rules</cite> attributes:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">rs</span> <span class="o">=</span> <span class="n">vt</span><span class="o">.</span><span class="n">Object</span><span class="p">(</span><span class="s2">&quot;hunting_ruleset&quot;</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">rs</span><span class="o">.</span><span class="n">name</span> <span class="o">=</span> <span class="s2">&quot;My test ruleset&quot;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">rs</span><span class="o">.</span><span class="n">rules</span> <span class="o">=</span> <span class="s2">&quot;rule test { condition:false }&quot;</span>
</pre></div>
</div>
<p>Post the object to the <cite>/intelligence/hunting_rulesets</cite> collection:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">rs</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">post_object</span><span class="p">(</span><span class="s2">&quot;/intelligence/hunting_rulesets&quot;</span><span class="p">,</span> <span class="n">obj</span><span class="o">=</span><span class="n">rs</span><span class="p">)</span>
</pre></div>
</div>
<p>Because we didn’t set the <cite>enabled</cite> attribute while creating the ruleset, it
was created with <cite>enabled=False</cite> by default:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">rs</span><span class="o">.</span><span class="n">enabled</span>
<span class="go">False</span>
</pre></div>
</div>
<p>Let’s enable the ruleset:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">rs</span><span class="o">.</span><span class="n">enabled</span> <span class="o">=</span> <span class="kc">True</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">rs</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">patch_object</span><span class="p">(</span><span class="s2">&quot;/intelligence/hunting_rulesets/</span><span class="si">{}</span><span class="s2">&quot;</span><span class="p">,</span> <span class="n">rs</span><span class="o">.</span><span class="n">id</span><span class="p">,</span> <span class="n">obj</span><span class="o">=</span><span class="n">rs</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">rs</span><span class="o">.</span><span class="n">enabled</span>
<span class="go">True</span>
</pre></div>
</div>
</section>
<section id="closing">
<h2>Closing<a class="headerlink" href="#closing" title="Permalink to this heading"></a></h2>
<p>Once you’re done using the client, call <cite>client.close()</cite> at the end of your
script, to make sure the client is properly closed. Otherwise you might see
tracebacks indicating the client was never closed.</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">client</span><span class="o">.</span><span class="n">close</span><span class="p">()</span>
</pre></div>
</div>
<p>If you use a <cite>context manager&lt;https://docs.python.org/3/reference/datamodel.html#context-managers&gt;</cite>,
the client is automatically closed after exiting, so there’s no need to call close:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="k">with</span> <span class="n">vt</span><span class="o">.</span><span class="n">Client</span><span class="p">(</span><span class="s1">&#39;&lt;apikey&gt;&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">client</span><span class="p">:</span>
<span class="gp">... </span>    <span class="n">file</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">get_object</span><span class="p">(</span><span class="s2">&quot;/files/44d88612fea8a8f36de82e1278abb02f&quot;</span><span class="p">)</span>
<span class="gp">... </span>    <span class="nb">print</span><span class="p">(</span><span class="n">file</span><span class="o">.</span><span class="n">type_tag</span><span class="p">)</span>
<span class="go">text</span>
</pre></div>
</div>
</section>
</section>


           </div>
          </div>
          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
        <a href="overview.html" class="btn btn-neutral float-left" title="Overview" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
        <a href="apireference.html" class="btn btn-neutral float-right" title="API reference" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
    </div>

  <hr/>

  <div role="contentinfo">
    <p>&#169; Copyright 2023, VirusTotal.</p>
  </div>

  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
    provided by <a href="https://readthedocs.org">Read the Docs</a>.


</footer>
        </div>
      </div>
    </section>
  </div>
  <script>
      jQuery(function () {
          SphinxRtdTheme.Navigation.enable(true);
      });
  </script>

</body>
</html>
